Suspicious MS Office Execution via DCOM

[rule]
description = """
Identifies suspicious modification of the Microsoft Office AccessVBOM security setting followed by the execution of
another Office process instance via DCOM. This may indicate an attempt to evade detection via suspicious process tree.
"""
id = "6a714747-2671-4523-b233-744f119949b6"
license = "Elastic License v2"
name = "Suspicious MS Office Execution via DCOM"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/blog/playing-defense-against-gamaredon-group",
    "https://stigviewer.com/stig/microsoft_powerpoint_2007/2014-04-03/finding/V-17522",
]
version = "1.0.31"

query = '''
sequence by user.id with maxspan=1m
   [registry where event.type == "change" and
    registry.path :
          ("HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM",
           "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM") and
    registry.data.strings == "1"]
   [process where event.action == "start" and
    (process.parent.name :("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
     process.parent.args : "-Embedding") and
    not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and process.args : "-u" and process.args : "-p") and
    not (process.pe.original_file_name == "ItSukurti.exe" and process.executable : "?:\\SamExpert\\ItSukurti.exe") and
    not (process.executable : "?:\\WINDOWS\\splwow64.exe" and process.args : "8192") and
    not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true) and
    not (process.code_signature.subject_name : ("Essential Objects, Inc.", "REFINITIV US LLC") and process.code_signature.trusted == true)]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"